Weakness (CWE)
CWE-16: Configuration
Weaknesses in this category are typically introduced during the configuration of the software.
Source: MITRE CWE-16
62 results · Feed
-
Low 3.1
HCL IEM was affected with X-Content-Type-Options Header Missing
HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
-
Low 3.9
This PowerVM Novalink update is being released to address
IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.
-
Low 1.9
An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service infor…
-
Low 2.1
CSRF Token not Properly Implemented
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
Medium 4.3
Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability
A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device …
-
Critical 9.8CVE-2024-46909 EPSS 49%
WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.
-
High 7.5
Configurations in Android Build
Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.
-
Medium 4.4
Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of th…
-
Medium 5.6
Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerabili…
-
High 7.5
Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerabil…
-
High 7.1
Privilege escalation vulnerability in the PMS module Impact: Successful exploitation of this vulnerability may affect s…
-
High 7.5
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerabilit…
-
High 7.5CVE-2023-33105 Public exploit
Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
High 7.2
Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical …
-
Unscored —
Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulner…
-
Unscored —
Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause Os…
-
High 7.8
Configuration weakness in modem
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
-
Medium 6.5
Zabbix Agent installer adds “allow all TCP any any” firewall rule
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
-
High 7.3
Debugging port misconfiguration in Zoom Apps in the Zoom Client for Meetings for macOS
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, …
-
High 7.4
Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
-
High 8.3
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
-
High 8.3
Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1…
-
High 7.5
Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port.
An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a specific open IPv4 port, which in affected releases should otherwise be unreachable, to cause the CPU to …
-
Unscored —
A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allo…
-
Medium 5.3
HTTP TRACK & TRACE Methods Enabled
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was r…
-
Medium 6.5
SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete files
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to delete files which may allow the attacker to disrupt the integrity…
-
Medium 5.3
SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive information
A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send a specially crafted query to cause the web server to disclose sensitive information in the HTTP response which allows t…
-
Unscored —
SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vu…
-
Medium 5.0
Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be …
-
High 7.4
Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.
A vulnerability in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending certain crafted protocol packets from an adjacent device with invalid payloads to the device. These crafted packets, which should be di…
-
High 7.8
A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an …
-
Medium 6.7
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configu…
-
High 7.5
Cisco Small Business Switches Information Disclosure Vulnerability
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible…
-
Medium 6.8
Philips Clinical Collaboration Platform Configuration
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
-
High 7.5
PAN-OS: Management web interface denial-of-service (DoS)
An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in…
-
Medium 5.3
Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device. The vulnerability is due to incorrect permissions w…
-
Medium 6.3
ABB eSOMS X-XSS-Protection not enabled
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.
-
Medium 6.5
eSOMS X-FrameOption
For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user inform…
-
Medium 6.5
eSOMS Cachecontrol (Pragma) HTTP Header
For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information.